Privacy policy

1. CONTROLLER

Lamport Sweden AB Company registration number: 556503-5770 Västberga allé 60 126 30 Hägersten, Sweden Email: kontakt@lamport.se

Lamport is the controller for personal data processed for Lamport’s own purposes, for example to manage Partner and business relationships, contracts, support, communications, invoicing, marketing and security in Lamport’s own systems.

2. WHAT PERSONAL DATA DO WE PROCESS AND WHY?

When Lamport acts as a controller, the following categories of personal data may be processed.

Contact details

Examples of data: Name, email address, telephone number, job title and company or organisation.

Purposes and legal basis:

Administration and management of Partner and business relationships: Processing is based on legitimate interests. Lamport’s legitimate interest is to establish, administer and maintain business relationships and communicate with relevant contact persons at Partners, customers and business partners.

Entering into and performing contracts: Where the data subject is personally a party to a contract with Lamport, processing is based on performance of a contract. Where the contract is with the data subject’s employer or organisation, processing of the contact person’s data is instead based on legitimate interests, namely Lamport’s interest in administering and performing the contractual relationship with the organisation.

Support and communication: Processing is based on legitimate interests. Lamport’s legitimate interest is to provide support, answer questions and communicate with users and contact persons as part of Lamport’s business relationships.

Information about Lamport’s products and services: Processing is based on legitimate interests. Lamport’s legitimate interest is to inform existing and potential business contacts about products and services that may be relevant to their professional roles.

For processing based on legitimate interests, Lamport carries out a balancing assessment and considers, among other things, the nature of the data, its relationship with the data subject, the data subject’s reasonable expectations and the scope of the processing.

User and security data

Examples of data: Usernames, access rights, sign-in details, activity logs and other information needed for administration and security.

Purposes and legal basis:

User administration and provision of services: Where the data subject is personally a party to a contract with Lamport, processing is based on performance of a contract. In other cases, processing is based on legitimate interests, namely Lamport’s interest in administering users and providing its services to Partners and other contracting parties.

Operation, support and troubleshooting: Processing is based on legitimate interests. Lamport’s legitimate interest is to ensure that its services function and remain available, and to identify and resolve technical problems.

Security: Processing is based on legitimate interests. Lamport’s legitimate interest is to protect its services, systems, users and information against unauthorised access, misuse, security incidents and other threats.

Communication data

Examples of data: Correspondence by email, telephone, web forms or other communication channels.

Purposes and legal basis:

Customer service, support and follow-up: Processing is based on legitimate interests. Lamport’s legitimate interest is to answer questions, provide support, follow up enquiries and maintain a functioning business relationship.

Contract-related communication: Where communication is necessary to enter into or perform a contract with the data subject, processing is based on performance of a contract. Where the contract is with the data subject’s employer or organisation, processing is based on legitimate interests, namely Lamport’s interest in administering and performing the contractual relationship with the organisation.

Technical information

Examples of data: IP address, device information, browser information and technical logs.

Purposes and legal basis:

Security, technical functionality, operation and troubleshooting: Processing is based on legitimate interests. Lamport’s legitimate interest is to maintain a secure, stable and functioning technical environment, prevent and detect security incidents, and identify and resolve technical faults.

Billing and contractual information

Examples of data: Billing details, contractual information and payment status.

Purposes and legal basis:

Contract management: Where processing is necessary to enter into or perform a contract with the data subject, processing is based on performance of a contract. Where the contract is with the data subject’s employer or organisation, processing is based on legitimate interests, namely Lamport’s interest in administering the contractual relationship.

Invoicing and financial administration: Processing is based on legitimate interests to the extent necessary for Lamport’s invoicing and financial administration.

Accounting and other statutory documentation: Processing is based on a legal obligation where Lamport is required to process and retain the data, for example under accounting legislation.

3. PERSONAL DATA PROCESSED ON BEHALF OF PARTNERS OR END CUSTOMERS

Lamport provides digital services, including the cloud-based Alarm Portal and associated services, to Partners. Partners may in turn provide these services to their end customers.

When Lamport processes personal data on behalf of a Partner or an end customer within these services, Lamport is not the controller for that processing.

Depending on the contractual and processing relationship, Lamport may instead act as a processor for the Partner or as a subprocessor where the Partner itself acts as a processor for its end customer.

In such cases, the controller determines the purposes of processing and is responsible for ensuring that there is a legal basis for it.

Personal data that a Partner or end customer chooses to register, upload or otherwise process in the Alarm Portal may, for example, appear in user details, documentation, notes, installation information and events.

Lamport’s processing of such personal data is governed by the applicable data processing agreement and documented instructions.

To exercise your rights regarding personal data that Lamport processes on behalf of a Partner or end customer, you should first contact the organisation that is the controller for that processing.

4. HOW DO WE COLLECT PERSONAL DATA?

When Lamport acts as a controller, personal data may be collected:

• directly from you,
• from your employer or organisation,
• from a Partner or another organisation with which Lamport has a business relationship, and
• through your use of Lamport’s digital services.

5. HOW LONG DO WE KEEP PERSONAL DATA?

Lamport keeps personal data only for as long as necessary for the purpose for which it is processed, or for as long as Lamport is required to retain it by law.

This means, for example, that:

• data necessary for Partner and contractual relationships is normally processed during the contract term and subsequently for as long as needed to handle or defend legal claims,
• support and communication data is retained for as long as needed for the relevant enquiry and appropriate follow-up,
• accounting records are retained for the period required under applicable accounting legislation, and
• user and security data is retained for as long as needed for administration, security and relevant logging purposes.

Where Lamport processes personal data as a processor or subprocessor, retention and deletion are instead determined by the applicable data processing agreement and the controller’s documented instructions.

6. RECIPIENTS AND SERVICE PROVIDERS

Lamport may share personal data with suppliers providing services necessary for Lamport’s business, for example IT, hosting, support, communications, financial administration and invoicing services.

Such suppliers may process personal data only to the extent necessary to provide the relevant service and must be subject to the required contractual and security obligations.

Lamport may also disclose personal data to authorities or other recipients where required by law or an official decision.

Where Lamport uses subprocessors to process personal data, that processing is governed by the relevant data processing agreement.

Lamport does not sell personal data or share personal data with third parties for their own marketing purposes.

7. TRANSFERS OUTSIDE THE EU/EEA

As a general rule, Lamport processes personal data within the EU/EEA.

If personal data is transferred to or made accessible from a country outside the EU/EEA, this must comply with applicable data protection legislation.

Where required, Lamport must ensure that there is a valid transfer mechanism under the GDPR and, where necessary, implement supplementary safeguards.

8. YOUR RIGHTS

Where Lamport acts as a controller, you have the right, to the extent provided by applicable data protection legislation, to:

• receive information about how your personal data is processed,
• request access to your personal data,
• request correction of inaccurate or incomplete personal data,
• request erasure of personal data,
• request restriction of processing,
• object to processing based on legitimate interests,
• request data portability where the conditions for this are met,
• where processing is based on consent, withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal,
• not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, and
• lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

To exercise any of your rights, you can contact Lamport at kontakt@lamport.se.

Where Lamport processes personal data as a processor or subprocessor, a request should first be addressed to the organisation acting as controller.

9. SECURITY

Lamport implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or other unlawful processing.

Where relevant, these measures include:

• authorisation and access controls,
• authentication,
• encrypted communications,
• protection of stored information,
• logging and traceability,
• backup and recovery, and
• restricted administrative access.

Lamport works continuously on the security and maintenance of the technical environments used to process personal data.

10. AUTOMATED DECISION-MAKING AND PROFILING

Lamport does not currently make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

If Lamport introduces such automated decision-making in the future, Lamport will inform you, including about the underlying logic and the significance and envisaged consequences of that processing, in accordance with applicable data protection legislation.

11. CHANGES TO THE PRIVACY POLICY

Lamport may update this privacy policy, for example following changes to Lamport’s business, services, personal data processing or applicable legal requirements.

The latest version is available through Lamport’s website and/or the Alarm Portal.

Lamport will inform affected individuals appropriately of material changes.